Crypto Exchanges in South Korea: FIU Registration, KRW Banking and Travel Rule

Choosing a crypto exchange in South Korea starts with a different set of questions from choosing a global offshore platform.

For a Korean user, the most important checks are:

1. Is the virtual asset service provider registered with the Korea Financial Intelligence Unit (KoFIU)?
2. Can the user activate the required real-name KRW bank account?
3. Does the exchange support the intended Travel Rule destination?
4. Which legal entity actually operates the account?
5. How are customer deposits and crypto assets safeguarded?
6. What are the actual KRW-pair liquidity, fees and withdrawal conditions?

South Korea's regulatory framework combines AML registration under the Act on Reporting and Using Specified Financial Transaction Information with customer-asset protections under the Act on the Protection of Virtual Asset Users.

The result is a market in which legal access, banking and transfer compatibility can matter as much as headline trading fees.

The short answer

For a South Korean user comparing exchanges, use this sequence:

KoFIU registration → legal entity → real-name bank → KRW market → Travel Rule compatibility → custody protections → fees → withdrawal route

Do not begin with:

• Number of listed tokens
• Promotional trading fees
• Global brand size
• Overseas licences
• App download count

A globally licensed exchange is not automatically permitted to target Korean users.

KoFIU has previously taken action against foreign-based VASPs that targeted Korean consumers without the required domestic registration.

1. Verify the current KoFIU registration record

KoFIU maintains the registration system for virtual asset service providers operating within South Korea's AML framework.

The current KoFIU website publishes a VASP registration-status notice dated July 31, 2026.

That is more useful than relying on an old article stating how many registered VASPs existed in a previous year.

Official source:

KoFIU — VASP Registration Status

Verify the legal company, not only the exchange name

Search the operator named in:

• Terms of service
• Privacy policy
• App publisher details
• Company footer
• KRW bank-account onboarding flow

Record:

Brand:
Korean legal entity:
KoFIU registration number:
Registration status:
Registered services:
Official domain:
Verification date:

For example, Cexvia currently maps Upbit's South Korean service to:

Brand:
Upbit

Legal entity:
Dunamu Inc.

Jurisdiction:
South Korea

Regulatory status:
Registered Virtual Asset Service Provider

Cexvia V1 rating:
70/100 — Moderate Risk

See:

Upbit Risk Rating, Licences and Safety

Cexvia also maintains a South Korea regulatory framework page:

South Korea Crypto Exchange Regulation

2. A foreign licence does not replace Korean registration

A common mistake is to assume:

Licensed abroad
=
allowed to serve Korean users

That is not a safe assumption.

KoFIU has previously referred foreign-based VASPs to investigative authorities for allegedly targeting Korean consumers without registration.

The 2022 enforcement action named multiple foreign exchanges, including:

• KuCoin
• MEXC
• Phemex
• XT.com
• Bitrue
• CoinEX
• Poloniex
• Pionex

among others.

KoFIU cited activity such as:

• Korean-language websites
• Promotions aimed at Korean consumers
• Payment methods targeting Korean users

Official reference:

FSC — Unregistered Operation of Foreign-Based VASPs in the Domestic Market

The practical rule is:

Do not use an offshore licence as a substitute for checking whether the provider is registered and legally serving South Korea.

3. Real-name bank access is part of the exchange decision

KRW trading is closely linked to the real-name bank-account framework.

For a user, this means the exchange choice can depend on whether the required banking relationship is available.

A low trading fee is irrelevant if the user cannot activate KRW deposits and withdrawals.

Current examples

As of August 2026, publicly available exchange materials show examples including:

Bank relationships can change and should be checked before account opening.

Upbit example

Upbit's support center currently states that only a K Bank account can be used for real-name deposit and withdrawal account verification.

Official reference:

Upbit — Real-name Account Verification

Bithumb example

Bithumb's current support and privacy materials reference KB Kookmin Bank account connection and customer-verification processes.

Coinone example

Coinone's 2026 notices continue to require users to connect a KakaoBank account for relevant KRW services and promotions.

Korbit operator name changed in August 2026

One current detail is easy to miss.

Korbit announced that its operating company changed its corporate name:

Previous:
Korbit, Inc.

New:
Digital X Co., Ltd.

Effective:
August 11, 2026

The consumer-facing Korbit brand remains in use, but the legal entity name changed.

This is exactly why current legal-entity verification matters.

Official reference:

Korbit — Operating Company Name Change

4. Compare KRW access before token selection

The banking route should be tested before a user evaluates thousands of trading pairs.

Check:

• Required bank
• Eligibility to open the bank account
• Real-name verification
• Mobile identity requirements
• KRW deposit limit
• KRW withdrawal limit
• Account-age restrictions
• Bank maintenance windows
• Security cooling-off periods

Account limits can come from the bank as well as the exchange

For example, Upbit currently notes that K Bank limited accounts can be subject to KRW transfer limits under Korea's virtual-asset real-name account operating guidelines.

That means the user's practical KRW capacity can depend on:

exchange limits
+
bank limits
+
identity level
+
security status

not merely the trading platform's advertised deposit policy.

5. Korea's Virtual Asset User Protection Act adds custody protections

The Act on the Protection of Virtual Asset Users took effect on July 19, 2024.

The framework introduced additional requirements relating to:

• Customer deposits
• Custody of customer crypto
• Cold-wallet storage
• Insurance or reserves
• Unfair trading
• Deposit and withdrawal restrictions

The Financial Services Commission has emphasized that these protections do not guarantee that crypto assets are safe investments.

Official reference:

FSC — Virtual Asset User Protection Act Takes Effect

6. Customer fiat deposits must be separated

Under the user-protection framework, customer money is required to be separated from VASP funds and held through eligible financial institutions.

The FSC selected banks as the custodian institutions for customer deposits under the detailed framework.

This is a customer-asset protection measure.

It should not be interpreted as:

all crypto assets are bank deposits

or:

token values are guaranteed

The legal treatment of KRW deposits and crypto assets is different.

7. At least 80% of customer crypto value must be stored in cold wallets

The FSC framework requires VASPs to keep at least 80% of the economic value of customers' virtual assets in cold wallets.

The calculation is based on the economic value of customer virtual assets and is reviewed periodically.

Official reference:

FSC — Rules on Protection of Virtual Asset Users

The cold-wallet requirement reduces a specific category of hot-wallet exposure.

It does not eliminate:

• Private-key risk
• Internal control failures
• Counterparty risk
• Operational outages
• Account takeover
• Token-price losses
• Blockchain risk

Cold-storage compliance should therefore be treated as one risk control, not a complete safety verdict.

8. VASPs must maintain insurance or reserves for specified incidents

The user-protection framework also requires VASPs to prepare for incidents such as:

• Hacking
• Computer failure

through liability insurance or reserves under the applicable rules.

For KRW-market exchange operators, the detailed framework includes minimum compensation or reserve requirements.

Again, this should not be interpreted as:

“All user losses are insured.”

The applicable protection depends on:

• Type of incident
• Amount
• Legal framework
• Policy or reserve scope
• Facts of the loss

Market losses are not converted into insured losses merely because the exchange complies with the law.

9. Korean law restricts arbitrary deposit and withdrawal blocking

The user-protection framework also addresses deposit and withdrawal restrictions.

The FSC's detailed rules state that VASPs are generally prohibited from arbitrarily blocking customer deposits and withdrawals without justifiable grounds.

Examples of circumstances where blocking may be justified include:

• Computer-system failure
• Requests from courts or investigative agencies
• Requests from tax or financial authorities
• Hacking incidents
• Situations where hacking is clearly expected

Where a justifiable reason exists, the user-protection framework includes notification requirements.

This is useful context when diagnosing a Korean exchange withdrawal problem.

It does not mean that every withdrawal delay is unlawful.

For troubleshooting:

Crypto Exchange Withdrawal Problems: How to Diagnose Delays, Holds and Missing Transfers

10. Travel Rule compatibility can decide whether a withdrawal works

South Korea's Travel Rule is particularly important for exchange-to-exchange transfers.

Under the rule currently in force on August 16, 2026, the statutory Travel Rule applies to transfers of KRW1 million or more between VASPs.

The originating VASP must provide information including:

• Sender name
• Receiver name
• Originating virtual-asset address
• Receiving virtual-asset address

Official reference:

FSC — Enforcement of Travel Rule on VASPs

Current rule as of August 16, 2026

Registered VASP → Registered VASP
Transfer amount ≥ KRW1,000,000
→ statutory Travel Rule applies

This threshold is important because Korea has already approved a future expansion—but that expansion is not yet current law as of this article's update date.

11. Important 2026 update: the Travel Rule is being expanded

On August 11, 2026, the Korean government approved revisions strengthening VASP registration and AML requirements.

The revised framework will eventually expand the Travel Rule from transfers of KRW1 million or more to transfers of all amounts between registered VASPs.

The FSC also announced additional requirements for certain transfers involving overseas VASPs or wallet-service providers.

These include a future reporting requirement for transfers of KRW10 million or more to overseas VASPs and/or digital-wallet service providers.

However, timing matters.

The FSC states:

• The enhanced VASP registration provisions take effect August 20, 2026.
• The other changes, including the expanded Travel Rule provisions, take effect six months after promulgation.

Therefore, on August 16, 2026, users should not yet treat the all-amount Travel Rule as the current operating threshold.

Official reference:

FSC — Rules Change Approved to Strengthen Registration and AML Requirements of VASPs

12. New VASP registration requirements begin August 20, 2026

The August 11 reform also materially strengthens the VASP registration framework.

The FSC states that the new registration conditions include financial-soundness and governance requirements.

Among the stated criteria:

• Debt ratio of 200% or below
• No default during the previous three years
• No relevant history of insolvency or revoked financial-business licensing
• Qualification requirements for executives
• Additional scrutiny of controlling and largest shareholders
• Adequate organizational expertise
• Cybersecurity infrastructure
• AML and user-protection internal controls

The registration-related provisions are scheduled to take effect on August 20, 2026.

This is an important change for future Cexvia Korea regulatory analysis.

KoFIU registration should increasingly be evaluated not merely as a filing record but in the context of the strengthened 2026 entry and renewal framework.

13. Travel Rule compatibility is not the same as blockchain compatibility

A withdrawal address can be technically valid while the transfer is still blocked by exchange policy or AML requirements.

A Korean exchange may maintain a list of:

• Supported domestic VASPs
• Supported overseas exchanges
• Verified wallet services
• Approved personal-wallet procedures

Before sending crypto, verify:

Asset
+
Network
+
Destination service
+
Travel Rule compatibility
+
Account-name requirement

A correct Ethereum or Tron address is not enough if the receiving service fails the exchange's Travel Rule or AML requirements.

Bithumb example

Bithumb currently publishes a list of exchanges to which virtual-asset deposits and withdrawals are permitted based on VASP registration or AML risk assessment.

Its public support page dated April 30, 2026 illustrates how transfer compatibility can be narrower than the technically possible blockchain destinations.

Official reference:

Bithumb — Supported Crypto Exchange Transfer List

14. Self-hosted wallets are a separate workflow

The statutory Travel Rule applies to transfers between VASPs under the current framework.

Transfers to self-hosted wallets can involve separate exchange-level ownership-verification and AML procedures.

The FSC has previously described wallet pre-registration practices as industry-level AML controls rather than the same thing as the statutory VASP-to-VASP Travel Rule.

Users should therefore check:

• Whether the exchange permits the wallet type
• Wallet ownership-verification process
• Allowed networks
• Withdrawal limits
• Additional security holds

Do not assume:

self-custody wallet
=
automatic unrestricted withdrawal

15. KRW liquidity should be compared pair by pair

After regulatory access and banking are confirmed, compare market quality.

Upbit and Bithumb are the most prominent KRW venues by market activity, but exchange-wide volume should not be the only metric.

For the exact token, compare:

• Best bid
• Best ask
• Bid-ask spread
• Depth within 0.5%
• Depth within 1%
• Recent trade frequency
• Slippage
• Withdrawal availability

A token can have high headline activity and still have poor exit depth outside a short period.

16. The Korea premium is not risk-free arbitrage

Korean crypto markets can trade at a premium or discount relative to overseas markets.

This is often described as the Kimchi Premium.

But a visible price difference does not automatically create executable arbitrage.

The user may face:

• Travel Rule restrictions
• Withdrawal delays
• KRW banking constraints
• Foreign-exchange rules
• Identity checks
• Network maintenance
• Transfer times
• Slippage

By the time the asset reaches the other venue, the price difference may have disappeared.

Cexvia Research should therefore treat cross-market price differences as a market-structure observation, not as a guaranteed trading opportunity.

17. Compare actual KRW trading costs

A Korean exchange comparison should model the complete transaction.

For a KRW10,000,000 trade:

0.05% fee
= KRW5,000

0.20% fee
= KRW20,000

But spread and slippage can exceed the explicit fee.

Compare:

KRW deposit
+
trading fee
+
spread
+
slippage
+
crypto withdrawal fee
+
KRW withdrawal fee

Promotional rates should not be treated as permanent fees.

Save the fee page or account quote used for the decision.

18. Listing quality and delisting risk matter

Korean exchanges may list different assets and can apply trading warnings or delistings.

Before buying a smaller token, review:

• Listing notice
• Investment-warning designation
• Trading-support termination notice
• Token migration
• Deposit suspension
• Withdrawal deadline
• DAXA-related notices where relevant

A locally popular token can have high temporary KRW volume while carrying material delisting or liquidity risk.

Token availability should therefore be evaluated together with the exit route.

19. Security controls should include the linked bank and phone

For Korean exchanges, the attack surface can include:

• Exchange account
• Linked bank account
• Mobile number
• Email
• Authentication app
• Registered withdrawal address

Recommended controls include:

• Passkey where available
• App-based authentication
• Unique email password
• Device monitoring
• Withdrawal address controls
• Bank-account alerts

Do not share:

• Authentication code
• Seed phrase
• Private key
• Remote-access credentials

with anyone claiming to be exchange support.

20. Tax records should be preserved even while tax rules evolve

South Korea's crypto tax policy has experienced multiple implementation changes.

For exchange selection, the practical recommendation is simple:

Preserve:

• Trade history
• KRW deposits
• KRW withdrawals
• Crypto deposits
• Crypto withdrawals
• Fees
• Wallet transfers
• Cost-basis records

Do not build an exchange decision around a tax rule remembered from an old article.

Use current National Tax Service guidance or qualified professional advice when tax treatment becomes relevant.

A practical South Korea exchange comparison framework

Use this order.

Step 1 — KoFIU

Is the current legal entity registered?

Step 2 — Legal entity

Does the company match:

• Terms
• App
• Domain
• KoFIU record?

Step 3 — Real-name bank

Can you activate the required bank relationship?

Step 4 — KRW access

Check:

• Deposit
• Withdrawal
• Limits
• Bank maintenance
• Verification

Step 5 — Travel Rule

Is the intended destination supported?

Step 6 — Asset protection

Review:

• Customer-deposit separation
• Cold-wallet policy
• Insurance / reserves
• Custody terms

Step 7 — Pair liquidity

Inspect the exact KRW pair.

Step 8 — Total cost

Calculate the full funding-trading-withdrawal cost.

Step 9 — Current operational status

Check:

• Withdrawals
• Banking rails
• Network maintenance
• Security events
• Regulatory action

Step 10 — Test the exit route

Complete a small permitted withdrawal before relying on the venue for a materially larger balance.

Cexvia's Korea verification model

For South Korean exchanges, Cexvia should map:

Brand
        ↓
Korean legal entity
        ↓
KoFIU registration
        ↓
Real-name bank
        ↓
KRW market access
        ↓
Travel Rule route
        ↓
Customer-asset safeguards
        ↓
Security / incident history
        ↓
Withdrawal status

This is more useful than a generic:

Regulated: Yes

because two registered Korean exchanges can still differ materially in:

• Corporate transparency
• Market liquidity
• Banking access
• Asset safeguards
• Security history
• Operational reliability
• Withdrawal compatibility

Cexvia currently rates Upbit 70/100 — Moderate Risk, with the South Korean entity mapped to Dunamu Inc.

For current evidence:

• Upbit Risk Profile
• South Korea Regulatory Framework
• Cexvia Exchange Risk Profiles
• Cexvia Risk Radar
• Cexvia Methodology

Frequently asked questions

What are the main crypto exchanges in South Korea?

The Korean KRW market is commonly associated with platforms including Upbit, Bithumb, Coinone, Korbit and GOPAX.

The operator, banking relationship and registration record should be verified at the time of account opening because corporate names and service arrangements can change.

Is Korbit still operated by Korbit, Inc.?

The Korbit brand remains in use, but the operating company announced a corporate-name change from Korbit, Inc. to Digital X Co., Ltd. effective August 11, 2026.

This is why users should search current legal-entity records rather than relying on old company names.

How do I check whether a Korean crypto exchange is registered?

Use KoFIU's current VASP registration-status publication and match the legal company in the exchange's terms.

Do not search only the brand.

Does KoFIU registration make an exchange safe?

No.

Registration establishes a regulatory relationship under the applicable framework.

Users should separately evaluate liquidity, custody, security history, withdrawals, corporate transparency and the specific product they intend to use.

Do Korean crypto exchanges require a bank account?

For KRW trading, real-name bank arrangements are a core part of the market structure.

The specific partner bank depends on the exchange and can change.

What is the current Korean crypto Travel Rule threshold?

As of August 16, 2026, the statutory Travel Rule applies to VASP-to-VASP transfers of KRW1 million or more.

The government has approved an expansion to all amounts, but the FSC states that those broader AML/Travel Rule changes will become effective six months after promulgation.

Will the Travel Rule threshold change?

Yes.

The August 11, 2026 reform expands the Travel Rule to all amounts between registered VASPs once the relevant provisions become effective.

Do not apply that future rule prematurely to transactions conducted under the current threshold.

Can Korean users transfer crypto to foreign exchanges?

Transfer availability depends on the Korean exchange's AML and Travel Rule policies, the destination exchange and the transfer facts.

A foreign exchange being globally accessible does not guarantee it is an approved destination.

Can I send crypto to my personal wallet?

Self-hosted wallet transfers can be subject to exchange-specific wallet verification and AML controls.

Check the exchange's current policy before initiating the transfer.

Are crypto assets on Korean exchanges insured?

Korean rules require safeguards including customer-asset segregation, cold-wallet requirements and insurance or reserves for specified incidents.

They do not insure token market value or guarantee reimbursement for every loss.

Why is my Korean exchange withdrawal blocked?

Possible causes include:

• Travel Rule compatibility
• Account-name mismatch
• Security hold
• Unsupported network
• Wallet maintenance
• Compliance review
• Legal restriction

Check whether a blockchain transaction hash has been created before deciding whether the issue is internal or on-chain.

Which Korean exchange has the best liquidity?

Liquidity depends on the specific KRW pair and time.

Upbit is a major domestic liquidity venue, but users should inspect spread, depth and recent trades for the exact asset rather than relying on exchange-wide rankings.

Conclusion

The Korean crypto exchange market should be compared through its local infrastructure, not through generic global exchange rankings.

The correct sequence is:

KoFIU registration → legal entity → real-name banking → KRW access → Travel Rule → customer-asset protection → liquidity → total cost → withdrawal route

South Korea's regulatory framework provides meaningful safeguards, including segregated customer deposits, cold-wallet requirements, insurance or reserves for specified incidents and controls around unfair trading and withdrawal restrictions.

But regulation does not remove market, custody, security or operational risk.

The latest 2026 regulatory changes make current verification even more important.

As of August 16:

• KoFIU's latest public VASP status is dated July 31, 2026.
• New strengthened VASP registration requirements are scheduled to take effect August 20, 2026.
• The current statutory Travel Rule threshold remains KRW1 million.
• The approved expansion to all VASP-to-VASP transfer amounts will take effect later under the FSC's stated implementation schedule.

For Cexvia, South Korea is therefore best represented not as a simple list of exchanges, but as an evidence chain linking the exchange brand to its registered Korean entity, banking route, transfer compatibility and current operational risk.

Primary sources and Cexvia resources

• KoFIU — VASP Registration Status
• KoFIU — Korea Financial Intelligence Unit
• FSC — Rules Change Approved to Strengthen Registration and AML Requirements of VASPs
• FSC — Enforcement of Travel Rule on VASPs
• FSC — Rules on the Protection of Virtual Asset Users
• FSC — Virtual Asset User Protection Act Takes Effect
• Upbit — Real-name Bank Account Verification
• Bithumb — Supported Crypto Exchange Transfer List
• Korbit — Operating Company Name Change
• Cexvia — South Korea Regulatory Framework
• Cexvia — Upbit Risk Profile
• Cexvia — Exchange Risk Profiles
• Cexvia — Risk Radar
• Cexvia — Methodology

*Cexvia evaluates centralized exchanges using publicly verifiable evidence across regulatory standing, corporate transparency, asset and solvency transparency, security history, and operations and user protection. Regulatory records are mapped to the relevant legal entity and jurisdiction. Ratings are evidence-based risk assessments, not guarantees of safety or recommendations to deposit or trade.*